i get this warning in logstash log [2017-11-13T10:41:22,803][WARN ][logstash.filters.json ] Error parsing json {:source=>"LogMsg", :raw=>"UID:420: Out /getData/{city}/{speciality}/{doctorName} all/all/all", :exception=>#<LogStash::Json::ParserError: Unrecognized token 'UID': was expecting ('true', …

Your first sample line does indeed have a LogMsg field that's JSON, but the second one doesn't. Perhaps you should use the json filter's skip_on_invalid_json option.

Discuss the Elastic Stack

Logstash warning

Elastic Stack Logstash

magnusbaeck (Magnus Bäck) November 20, 2017, 6:48am 6

Either that, or remove the json filter. Just don't keep both.

1 Like

Topic		Replies	Views
Logstash JSON parser error Logstash	5	796	February 16, 2023
Logstash can't process all JSON logs Logstash	5	3076	August 13, 2018
Logstash json parse failure when json contains a "message" field Logstash	6	3490	July 4, 2019
Constant JSON parse errors in logstash output log Logstash	3	6903	April 19, 2017
Parse Logstash.log with logstash Logstash	2	728	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Logstash warning

Related topics